URLs are defined in presets.js. Update that file to add or remove sources.
presets.js
When enabled, the embedded player runs inside an iframe sandbox with allow-scripts allow-same-origin.
allow-scripts allow-same-origin